US20240362007A1 - Software update device, software update system, and software update method - Google Patents

Software update device, software update system, and software update method Download PDF

Info

Publication number
US20240362007A1
US20240362007A1 US18/292,251 US202118292251A US2024362007A1 US 20240362007 A1 US20240362007 A1 US 20240362007A1 US 202118292251 A US202118292251 A US 202118292251A US 2024362007 A1 US2024362007 A1 US 2024362007A1
Authority
US
United States
Prior art keywords
update
software
information
vehicle
estimated time
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
US18/292,251
Other languages
English (en)
Inventor
Mitsuhiko KIKUCHI
Koji Morita
Yoshimori SHIZUKA
Eisuke OHASHI
Masaaki Uzumi
Muneeswaran Ayyappan
Yohei KAIEDA
Takayuki Inoue
Hidetoshi Hayashi
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nissan Motor Co Ltd
Original Assignee
Nissan Motor Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nissan Motor Co Ltd filed Critical Nissan Motor Co Ltd
Assigned to NISSAN MOTOR CO., LTD. reassignment NISSAN MOTOR CO., LTD. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: INOUE, TAKAYUKI, AYYAPPAN, Muneeswaran, HAYASHI, HIDETOSHI, KIKUCHI, Mitsuhiko, MORITA, KOJI, OHASHI, Eisuke, SHIZUKA, Yoshimori, UZUMI, Masaaki, KAIEDA, Yohei
Publication of US20240362007A1 publication Critical patent/US20240362007A1/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/451—Execution arrangements for user interfaces

Definitions

  • the present invention relates to a software update device, a software update system, and a software update method.
  • a conventional information processing terminal is known that can automatically update software at a timing according to a user's preference (Patent Document 1).
  • This information processing terminal can also be used as an in-vehicle terminal mounted on a vehicle.
  • Patent Document 1 Japanese Patent Application Publication No. 2016-38634
  • the problem to be solved by the present invention is to provide a software update device, a software update system, and a software update method that allow a user to use a vehicle even when an error occurs that prevents an update of software from being completed.
  • the present invention solves the above problem by acquiring, from a server provided outside a vehicle, update process information related to an update of software of an in-vehicle control device; outputting consent request information for asking a user whether to consent to the update of software; executing an update process according to response information that is a response to the consent request information from the user; causing, when the update is not completed within an estimated time required for the update, the in-vehicle control device to execute a program corresponding to a pre-update software; and causing, when the update is completed within the estimated time, the in-vehicle control device to execute a program corresponding to an updated software.
  • the in-vehicle control device can determine which software is to be executed, allowing the user to use the vehicle.
  • FIG. 1 is a block diagram illustrating an example of a software update system including a software update device according to a first embodiment.
  • FIG. 2 is an explanatory diagram for explaining a flow of an update of software by OTA.
  • FIG. 3 is an explanatory diagram for explaining an update of software by OTA depending on the memory configuration of an ECU.
  • FIG. 4 is an example of functional blocks included in a controller of the software update device illustrated in FIG. 1 .
  • FIG. 5 is a flowchart of a software update method according to the first embodiment.
  • FIG. 6 is an example of functional blocks included in a controller of a software update device according to a second embodiment.
  • FIG. 7 is a flowchart of a software update method according to the second embodiment.
  • FIG. 1 is a block diagram illustrating an example of the software update system 100 according to the present embodiment.
  • the software update system 100 is a system that can update software for vehicle control, diagnosis, and the like, which are executed by an electronic control unit (hereinafter referred to as ECU) of a vehicle 1 by Over-The-Air (OTA).
  • ECU electronice control unit
  • OTA Over-The-Air
  • Such an update of software by OTA is also referred to as Firmware Over-The-Air (FOTA).
  • FOTA Firmware Over-The-Air
  • the software for the ECU is implemented by a microcomputer included in the ECU executing a program.
  • the software update system 100 can also be applied to a case of wirelessly rewriting data used in various software, such as map data used in a navigation system of the vehicle 1 and control parameters used in the ECU, for example. Further, for an ECU using a field programmable gate array (FPGA), the software update system 100 can also be applied to a case of wirelessly rewriting the functions (logics) of the FPGA. Further, although one vehicle is illustrated as the vehicle 1 in FIG. 1 , the software update system 100 is a system that can update software for a plurality of vehicles 1 .
  • FPGA field programmable gate array
  • an update of software for the ECU means that the version of the software for the ECU is changed to a new version, that is, a program to be executed by the microcomputer is changed to a new version.
  • a wireless update of software includes, in addition to wirelessly acquiring a new version of the program itself from outside the vehicle 1 and rewriting it, wirelessly acquiring various data used to execute the new version of the program, and differential data between the new version of the program and the old version of the program from outside the vehicle 1 and rewriting it.
  • update data data necessary for updating software, such as a new version of a program or differential data.
  • a “new version of a program” is referred to as a “new program”
  • an “old version of the program” is referred to as an “old program”
  • “differential data between a new version of a program and an old version of the program” is referred to as “differential data”.
  • “completion of process” means that the process has been successfully completed, and does not include that the process has ended abnormally.
  • a user who is outside the vehicle 1 will be described as an example of a user who performs procedures related to an update of software.
  • the software update system 100 includes the vehicle 1 , a server 2 , and a user terminal 3 .
  • the components included in the software update system 100 are configured to exchange information via a wireless communication network 4 .
  • the wireless communication network 4 includes, for example, a mobile communication network such as a 4G network, the Internet, Wi-Fi (Wireless Fidelity) (registered trademark), and the like.
  • ECUs for which software can be updated are mounted.
  • the vehicle 1 exchanges various information related to an update of software with the server 2 .
  • Information related to each ECU mounted in the vehicle 1 is transmitted from the vehicle 1 to the server 2 .
  • Information related to the ECU includes, for example, the current version of software.
  • Information related to each ECU mounted in the vehicle 1 is transmitted from the vehicle 1 to the server 2 based on a predetermined transmission condition (e.g., in a predetermined cycle).
  • information related to an update of software is transmitted from the server 2 to the vehicle 1 .
  • Examples of the information related to the update of software include campaign information, update data, an estimate of the time required for an update process, the importance of the update, and the like.
  • the campaign is an event in which the server 2 distributes a distribution package to one or more vehicles 1 .
  • the distribution package includes update data, authentication data used for an authentication process for the update data, and the like.
  • the campaign information is information for presenting the overview of the update of software to the user. Specific examples of the campaign information and the estimate of the time required for the update process will be described later.
  • the estimate of the time required for the update process may be included in the distribution package.
  • the update process for software is executed in the vehicle 1 by the software update device 10 , which will be described later.
  • the update process is started in the vehicle 1 , information indicating the progress of the update process is transmitted from the vehicle 1 to the server 2 .
  • the server 2 is a server that controls the software update process in the software update system 100 and functions as an OTA center.
  • the server 2 exchanges various information related to the update of software described above with the vehicle 1 . Further, the server 2 also exchanges various information with the user terminal 3 .
  • the server 2 has a storage function for storing update data, a data management function for managing the versions of each piece of software, the vehicle identification number (VIN) of the vehicle 1 to be updated, the ECU to be updated, and the like, a campaign management function for managing information related to campaign such as a distribution timing for campaign information, a distribution function for distributing campaign information and update data, and the like.
  • a storage device For example, when receiving various information including update data from a provider for the update data, the server 2 stores the update data in a storage device. The server 2 identifies based on the information received from the provider the VIN for which the update data is to be distributed and the ECU to be updated (hereinafter referred to as update target ECU).
  • the server 2 sets a distribution timing for campaign information, and when the distribution timing for campaign information comes, the server 2 transmits the campaign information to the vehicle 1 and/or the user terminal 3 . If the user consents to a distribution package being transmitted to the vehicle 1 , the server 2 transmits the distribution package to the vehicle 1 .
  • the server 2 receives progress information indicating the progress of the update process from the vehicle 1 , and transmits the received progress information to the user terminal 3 .
  • the user terminal 3 is a terminal that can be carried by the user and has a function of receiving an operation input from the user and a function of displaying various screens. Examples of the user terminal 3 include a smartphone, a tablet, and the like.
  • the user terminal 3 exchanges various information such as campaign information with the server 2 .
  • campaign information such as campaign information
  • the user terminal 3 notifies the user of the campaign information.
  • the user terminal 3 transmits consent information indicating the user's consent to the server 2 .
  • the user terminal 3 also exchanges information related to an update process with the vehicle 1 through the server 2 .
  • the user terminal 3 When the user terminal 3 receives from the server 2 an input of information for asking the user for consent to start the update process, the user terminal 3 displays an image for asking the user for consent. Further, when the user performs an operation on the user terminal 3 indicating consent to start the update process, the user terminal 3 transmits consent information indicating the user's consent to the server 2 .
  • the user terminal 3 receives progress information from the server 2 , and notifies the user of the received progress information.
  • the server 2 includes a communication device 21 , a database 22 , and a control device 23 .
  • the communication device 21 has a communication function for performing data communication with the vehicle 1 and the user terminal 3 via the wireless communication network 4 .
  • the vehicle 1 In order for the communication device 21 to transmit and receive data to and from the vehicle 1 , the vehicle 1 needs to be located within the range of the wireless communication network 4 . Further, in order for the communication device 21 to transmit and receive data to and from the user terminal 3 , the user terminal 3 needs to be located within the range of the wireless communication network 4 .
  • the database 22 stores registration information of the vehicle 1 , campaign information, update data, and the like.
  • the registration information of the vehicle 1 includes at least the VIN of the vehicle 1 , the number of ECUs mounted in the vehicle 1 , the type of each ECU, and the software version of each ECU.
  • the campaign information includes the data size of the update data, information for identifying the update target ECU (ECU name, ECU ID, etc.), information on the version of the software to be updated (version name, version ID, etc.), a general description of the function to be updated, an estimated time required to complete the download of a distribution package (estimated download time), an estimated time required to complete the update process in the vehicle 1 (estimated update process time), and the like.
  • the control device 23 is a device that functions as a control tower for the server 2 , and includes, for example, a processor and a memory programmed to execute one or more functions implemented by a computer program.
  • the control device 23 has the data management function, the campaign management function, the distribution function, and the like, which are described above. In the present embodiment, a function of calculating an estimated update process time will be described as an example of a function of the control device 23 .
  • the control device 23 calculates an estimated update process time based on the data size of the update data. For example, if a map indicating a relationship between the data size of update data and an estimated update process time is stored in the database 22 in advance, the control device 23 refers to the map to calculate the estimated update process time corresponding to the data size. Further, for example, the control device 23 calculates the estimated update process time such that it is longer as the data size of the update data is larger.
  • the data size of the update data may be either the data size of the new program itself or the data size of the differential data.
  • control device 23 may calculate the estimated update process time based on the type of the update target ECU instead of or in addition to the data size of the update data. For example, the control device 23 calculates the estimated update process time based on the specifications of the microcomputer and/or flash memory included in the ECU. For example, if the operating frequency of the microcomputer included in the update target ECU is higher than a predetermined reference frequency, the control device 23 calculates the estimated update process time such that it is shorter than in a case where the operating frequency of the microcomputer is lower than the predetermined reference frequency. This is based on the viewpoint that the higher the operating frequency of the microcomputer, the shorter the time required for the update process.
  • the control device 23 calculates the time required for the update process such that it is longer than in a case where the memory capacity of the flash memory is smaller than the predetermined reference capacity. This is based on the viewpoint that the larger the memory capacity of the flash memory, the larger the file size of the program and the longer the time required for the update process. Further, the method for calculating an estimated update process time is just one example, and the control device 23 may calculate an estimated update process time using other calculation methods.
  • the user terminal 3 includes a terminal communication device 31 , a terminal human machine interface (HMI) 32 , and a terminal control device 33 .
  • HMI human machine interface
  • the terminal communication device 31 has a function of performing data communication with the server 2 via the wireless communication network 4 .
  • the terminal HMI 32 functions as at least one of a device that receives an operation input from the user and a device that notifies the user of information. Examples of the terminal HMI 32 include a touch panel display and the like. Note that the terminal HMI 32 is not limited to a device that displays information, but may be a device that outputs information in audio, such as a speaker. Note that in a case where the user terminal 3 is directly connected to an in-vehicle device of the vehicle 1 via Bluetooth (registered trademark) or the like, the user terminal 3 may perform data communication with the server 2 through an in-vehicle communication device 11 of the vehicle 1 . Further, in a case where an in-vehicle device and the user terminal 3 are directly connected to each other, the in-vehicle device may communicate with the server 2 from the user terminal 3 via the wireless communication network 4 .
  • the terminal control device 33 is a device that functions as a control tower for the user terminal 3 , and includes, for example, a processor and a memory programmed to execute one or more functions implemented by a computer program.
  • the terminal control device 33 executes a process for notifying the user of campaign information and progress information of the update process.
  • campaign information as an example, when receiving campaign information from the server 2 through the terminal communication device 31 , the terminal control device 33 outputs the campaign information to the terminal HMI 32 and causes the terminal HMI 32 to display the campaign information.
  • the terminal control device 33 executes a consent request process for asking the user for consent in the software update process for the ECU of the vehicle 1 .
  • the terminal control device 33 Taking a case of asking the user for consent to start the update process as an example, the terminal control device 33 generates a consent request image for asking the user for consent to start the update process, outputs the consent request image to the terminal HMI 32 , and causes the terminal HMI 32 to display the consent request image.
  • the user terminal 3 When the user terminal 3 is located within the range of the wireless communication network 4 , the user who is outside the vehicle 1 is allowed to perform an operation input while checking various information related to the update of software on the user terminal 3 , to perform procedures related to the update of software.
  • the block configuration and functions of the user terminal 3 described above are merely examples, and do not limit the user terminal 3 .
  • a case will be described by way of example in which the user uses the user terminal 3 to perform procedures related to an update process.
  • the software update device, the software update system, and the software update method according to the present invention can also be applied to a case in which the user uses an in-vehicle terminal 12 to perform the procedures related to the update process.
  • the vehicle 1 includes the software update device 10 , the in-vehicle communication device 11 , the in-vehicle terminal 12 , an ignition switch 13 , a body system ECU 14 A, a traveling system ECU 14 B, a multimedia system ECU 14 C, and a power supply system ECU 14 D.
  • the components included in the vehicle 1 are connected by an in-vehicle network such as a Controller Area Network (CAN) or a Local Interconnect Network (LIN).
  • CAN Controller Area Network
  • LIN Local Interconnect Network
  • the in-vehicle communication device 11 has a function of performing data communication with the server 2 via the wireless communication network 4 .
  • Examples of the in-vehicle communication device 11 includes a telematics control unit (TCU).
  • TCU telematics control unit
  • the in-vehicle terminal 12 is a terminal that has a function of receiving an operation input from the user (occupant) riding in the vehicle 1 and a function of displaying various screens. Examples of the in-vehicle terminal 12 include a touch panel display and the like. Signals for notifying the occupant of various information are input to the in-vehicle terminal 12 from the software update device 10 . For example, when information for asking the occupant for consent to start the update process is input from the software update device 10 , the in-vehicle terminal 12 displays an image for asking the occupant for consent.
  • the in-vehicle terminal 12 when the occupant performs an operation on the in-vehicle terminal 12 indicating consent to start the update process, the in-vehicle terminal 12 outputs consent information indicating the occupant's consent to the software update device 10 .
  • the vehicle 1 is located within the range of the wireless communication network 4 , the user inside the vehicle 1 is allowed to perform an input operation while checking various information related to the update of software on the in-vehicle terminal 12 , to perform procedures related to the update of software.
  • the in-vehicle terminal 12 is not limited to a device that displays information, but may be a device that outputs information in audio, such as a speaker.
  • the ignition switch 13 functions as a starting switch for the vehicle 1 and is a switch for turning the ignition of the vehicle 1 on or off. For example, when the occupant performs an operation to turn the ignition from on to off, the ignition switch 13 outputs a signal indicating the content of the user's operation to the software update device 10 .
  • the body system ECU 14 A, the traveling system ECU 14 B, and the multimedia system ECU 14 C are examples of ECUs to be updated by the software update device 10 .
  • Each ECU includes as functional blocks a microcomputer that includes a central processing unit (CPU), a read only memory (ROM), a random access memory (RAM), and a flash memory; a power supply circuit; a data transfer circuit; and the like.
  • the flash memory stores programs for implementing software for the ECU.
  • the software for the ECU is implemented by the microcomputer executing the program(s) stored in the flash memory to perform various processes.
  • the flash memory of the ECU is divided into single bank memory and double bank memory depending on the memory configuration.
  • the single bank memory there is no distinction between a storage area for programs and a program execution area for the microcomputer, and a program cannot be rewritten in the single bank memory while the microcomputer is executing the program.
  • the double bank memory has two areas as program storage areas, and the microcomputer executes a program in one of the two storage areas. Therefore, in the double bank memory, even while the microcomputer is executing the program, a program can be written to the other storage area that does not store the program being executed.
  • the two program storage areas of the double bank memory will hereinafter be referred to as a first memory and a second memory for convenience.
  • the body system ECU 14 A is a general term for ECUs that control the body system of the vehicle 1 .
  • Examples of the body system ECU 14 A include a door control ECU that controls locking/unlocking of the doors of the vehicle 1 , a meter control ECU that controls the meter display of the vehicle 1 , an air conditioner control ECU that controls the driving of the air conditioner of the vehicle 1 , a window control ECU that controls opening and closing of one window of the vehicle 1 , and the like.
  • the traveling system ECU 14 B is a general term for ECUs that control the traveling system of the vehicle 1 .
  • Examples of the traveling system ECU 14 B include a drive source control ECU that controls the drive source of the vehicle 1 , a brake control ECU that controls the drive of the brakes of the vehicle 1 , a power steering control ECU that controls the drive of the power steering of the vehicle 1 , and the like.
  • the multimedia system ECU 14 C is a general term for ECUs that control the multimedia system of the vehicle 1 .
  • Examples of the multimedia system ECU 14 C include a navigation control ECU that controls the navigation system of the vehicle 1 , an audio control ECU that controls the audio devices of the vehicle 1 , and the like.
  • Control signals for an update process are input from the software update device 10 to the body system ECU 14 A, the traveling system ECU 14 B, and the multimedia system ECU 14 C, so that each ECU executes the update process for software.
  • each ECU is illustrated as one in FIG. 1
  • the number of update target ECUs is not particularly limited, and the software update system 100 can update software for a plurality of update target ECUs.
  • the body system ECU 14 A, the traveling system ECU 14 B, and the multimedia system ECU 14 C, which are illustrated in FIG. 1 are examples of ECUs to be mounted in the vehicle 1 , but do not limit to the types of ECUs to be mounted in the vehicle 1 and the way of distinguishing between ECUs.
  • the vehicle 1 may be equipped with an ECU(s) other than the ECUs illustrated in FIG. 1 .
  • the power supply system ECU 14 D is a general term for ECUs that control the power supply system of the vehicle 1 .
  • Examples of the power supply system ECU 14 D include a power supply control ECU that controls an ACC (accessory) power source and an IG (ignition) power source, which are mounted in the vehicle 1 .
  • a control signal for an update process is input from the software update device 10 to the power supply system ECU 14 D.
  • the power supply system ECU 14 D executes a process of turning off the ignition of the vehicle 1 .
  • FIG. 2 is an explanatory diagram for explaining a flow of an update of software by OTA.
  • an update of software by OTA is performed through multiple stages. Specifically, in an update of software by OTA, notification of campaign information (step S 1 ), download (step S 2 ), installation (step S 3 ), activation (step S 4 ), and confirmation of update completion (step S 5 ) are sequentially performed.
  • step S 1 campaign information is transmitted from the server 2 to the vehicle 1 and/or the user terminal 3 , and the user is notified of the campaign information through the in-vehicle terminal 12 and/or the user terminal 3 .
  • step S 2 a distribution package including update data is transmitted from the server 2 to the vehicle 1 , and the distribution package is stored in the vehicle 1 .
  • step S 3 a process of writing a new program is performed for the update target ECU.
  • step S 4 a process of loading the new program is performed by the microcomputer to enable the new program.
  • step S 5 the user is notified of the completion of the update of software through the in-vehicle terminal 12 and/or the user terminal 3 .
  • FIG. 3 is an explanatory diagram for explaining an update of software by OTA depending on the memory configuration of an ECU.
  • each step of download, installation, activation, and confirmation of update completion among the plurality of steps illustrated in FIG. 2 is represented as “update state”.
  • the state of the vehicle 1 in each update state is represented as “vehicle state”, the operation of the update target ECU as “target ECU”, and the state of the user as “user”.
  • (A) of FIG. 3 is an example of the software update flow for a single bank memory configuration for an ECU
  • (B) of FIG. 3 is an example of the software update flow for a double bank memory configuration for an ECU.
  • “download” of a distribution package is performed in the vehicle 1 with the vehicle 1 being ready to travel (the ignition switch 13 being on). After the download is completed, when the ignition switch 13 is switched from on to off with the vehicle 1 being stopped, a “consent request” is made to ask the user for consent to start an update process.
  • the user outside the vehicle 1 performs an operation input while checking various information related to the update of software on the user terminal 3 , to perform procedures related to the update of software.
  • the user terminal 3 displays information for asking for consent to start the update process (e.g., displaying “Do you want to update the software?”) and two user-operable icons: an icon indicating consent (e.g., displaying “Right Now”) and an icon indicating refusal (e.g., displaying “Later”).
  • an icon indicating consent e.g., displaying “Right Now”
  • an icon indicating refusal e.g., displaying “Later”.
  • “installation” using the update data is performed in the vehicle 1 .
  • a rewrite process is performed to write a new program after deleting the old program.
  • the software update process for the ECU will not start in the vehicle 1 , and the process of turning off the ignition of the vehicle 1 will be executed by the power supply system ECU 14 D. Further, an update process postponement notification indicating that the update process is postponed is displayed on the user terminal 3 (e.g., displaying “Postponed to next time”).
  • the user terminal 3 displays, for example, information for asking for consent to start the update process, an icon indicating consent, and an icon indicating refusal.
  • “activation” is performed to change the load memory for the microcomputer from the first memory to the second memory. After that, the update of software is completed through a power restart process for the vehicle 1 .
  • the vehicle 1 executes the update process regardless of either update process when the occupant is requested to consent to start the update process and then the occupant performs an operation to consent to start the update process. Further, when the update process is completed, the user can know that the update process has been completed through the update completion notification displayed on the user terminal 3 .
  • the software update device 10 aims to solve the above problem with the following configuration and method.
  • the software update device 10 includes a controller 40 .
  • FIG. 4 is an example of functional blocks included in the controller 40 of the software update device 10 .
  • the controller 40 is configured by a computer including hardware and software, and includes a memory that stores programs, a CPU that executes a program stored in this memory, and others.
  • the operable circuits to be used can include, instead of or together with the CPU, an MPU, a DSP, an ASIC, an FPGA, and the like.
  • the controller 40 includes as functional blocks an information acquisition unit 41 , a storage unit 42 , an output unit 43 , a start determination unit 44 , an update process execution unit 45 , a control unit 50 , and a power supply process execution unit 51 .
  • the controller 40 implements each function of the functional blocks using software stored in the memory.
  • the information acquisition unit 41 acquires update process information related to an update of software from the server 2 through the in-vehicle communication device 11 .
  • the update process information includes the above-described campaign information and distribution package. Further, the information acquisition unit 41 also acquires a signal indicating the on state or off state of the ignition switch 13 from the ignition switch 13 . Further, the information acquisition unit 41 acquires a signal indicating a user's operation from the in-vehicle terminal 12 . Further, the information acquisition unit 41 acquires a signal indicating a user's operation on the user terminal 3 through the server 2 .
  • the information acquisition unit 41 acquires, from the user terminal 3 through the server 2 , a signal indicating that the consent indication has been pressed by the user. Further, for example, when the user presses a refusal indication displayed on the user terminal 3 , the information acquisition unit 41 acquires, from the user terminal 3 through the server 2 , a signal indicating that the refusal indication has been pressed by the user.
  • the storage unit 42 functions as a storage device that stores information acquired from the server 2 among the information acquired by the information acquisition unit 41 .
  • a nonvolatile recording medium such as a flash memory is used.
  • the storage unit 42 stores the campaign information and distribution package acquired from the server 2 . Further, the storage unit 42 may store information related to the ECU mounted on the vehicle 1 (memory configuration for the ECU, etc.). Various information stored in the storage unit 42 is used for processing by the update process execution unit 45 .
  • the output unit 43 outputs consent request information for asking the user whether to consent to start the update process by the update process execution unit 45 .
  • the consent request information include images, audio, and the like, but the method of asking the user for consent is not particularly limited. For example, an indication image of “Do you want to update the software?” as described above is read from the memory, and the corresponding image signal is transmitted to the server 2 through the in-vehicle communication device 11 . Further, for example, the output unit 43 may transmit an audio signal for asking the user whether to consent to start the update process to the server 2 through the in-vehicle communication device 11 together with or in place of the image signal.
  • the consent request information transmitted from the in-vehicle communication device 11 is received by the server 2 , and then transmitted from the server 2 to the user terminal 3 .
  • the output unit 43 outputs the consent request information when a predetermined output condition is satisfied.
  • the output unit 43 determines whether or not the ignition switch 13 has been turned from on to off by the occupant, based on the information acquired by the information acquisition unit 41 .
  • the output unit 43 outputs the consent request information when a signal indicating the state of the ignition switch 13 switches from the on state to the off state.
  • the output condition for the output unit 43 is merely an example, and the output condition may be other conditions.
  • the start determination unit 44 determines whether or not the update process execution unit 45 should start the update process. If the user consents to start the update process in response to the consent request information output by the output unit 43 , the start determination unit 44 determines that the update process is to start; if the user refuses to start the update process in response to the consent request information, the start determination unit 44 determines that the update process is not to start. For example, when the user performs an operation on the user terminal 3 indicating consent to start the update process, the information acquisition unit 41 acquires consent information from the server 2 , and the start determination unit 44 determines that the update process is to start, as described above.
  • the information acquisition unit 41 acquires refusal information from the server 2 , and the start determination unit 44 determines that the update process is not to start, as described above.
  • the update process execution unit 45 executes the update process depending on response information that is a user's response to the consent request information.
  • the update process execution unit 45 executes the update process; when the start determination unit 44 determines that the update process is not to start, the update process execution unit 45 postpones the execution of the update process.
  • the update process in the update target ECU is successfully completed, the update process execution unit 45 receives an update process completion notification from the update target ECU, and the update process execution unit 45 outputs the input notification to the control unit 50 . Note that when the start determination unit 44 determines that the update process is not to start, the execution of the update process may be postponed, and the update process execution unit 45 may execute other processes.
  • the update process execution unit 45 includes, as functional blocks that execute an update process, installation execution units and activation execution units, depending on the memory configuration of the update target ECU. As illustrated in FIG. 4 , the update process execution unit 45 includes a first installation execution unit 46 and a first activation execution unit 47 , which correspond to a single bank memory configuration, and a second installation execution unit 48 and a second activation execution unit 49 , which correspond to a double bank memory configuration. As described with reference to FIG. 3 , the processing contents of “installation” and “activation” differ depending on whether the ECU has the single bank or double bank memory configuration. Therefore, in the present embodiment, a plurality of installation execution units and a plurality of activation execution units are provided.
  • the first installation execution unit 46 installs a new program, and the first activation execution unit 47 activates the new program.
  • the second installation execution unit 48 installs a new program, and the second activation execution unit 49 activates the new program.
  • the update process execution unit 45 determines the memory configuration of the update target ECU from the information related to the ECU mounted on the vehicle 1 stored in the storage unit 42 .
  • the first installation execution unit 46 executes an installation process for writing a new program after deleting the old program stored in the flash memory.
  • the first activation execution unit 47 executes an activation process for causing the microcomputer included in the update target ECU to load the new program written in the flash memory.
  • the second installation execution unit 48 executes an installation process for writing the new program to the second memory where the old program is not stored.
  • the second activation execution unit 49 executes an activation process for changing the program load destination for the microcomputer included in the update target ECU from the first memory to the second memory.
  • the control unit 50 determines a target program to be executed by the update target ECU based on an estimated time required for the update process.
  • the estimated time required for the update process is the estimated update process time calculated by the server 2 .
  • the specific content of the update process is for “installation” as well as “activation” or “activation” depending on the memory configuration of the update target ECU. Therefore, the details of the estimated update process time calculated by the server 2 vary depending on the specifications of the update target ECU.
  • the estimated update process time is composed of a time required for the installation process and a time required for the activation process.
  • the estimated update process time is composed of a time required for activation.
  • control unit 50 causes the update target ECU to execute an old program corresponding to a pre-update software.
  • control unit 50 causes the update target ECU to execute a new program corresponding to the updated software.
  • the control unit 50 starts a timer for measuring the update process time and starts measuring the elapsed time from the start of the update process.
  • the control unit 50 waits for an update process completion notification to be input from the update process execution unit 45 while comparing the elapsed time and the estimated update process time.
  • the update process completion notification is input in an elapsed time shorter than the estimated update process time
  • the control unit 50 causes the microcomputer included in the update target ECU to execute the new program.
  • the control unit 50 causes the microcomputer included in the update target ECU to execute the old program.
  • the processing of the control unit 50 when the elapsed time exceeds the estimated update process time will be described in more detail.
  • the control unit 50 executes a different process depending on the memory configuration of the update target ECU.
  • the control unit 50 executes a rollback process on the update target ECU.
  • Rollback refers to writing or writing back in order to restore the flash memory of the update target ECU to a predetermined state, such as restoring the program version to the previous one, when the update process is interrupted.
  • rollback refers to returning the state of the update target ECU to the state before the start of the update process from the user's perspective.
  • a rollback process known at the time of filing of the present application can be applied to the control unit 50 . For example, if the distribution package includes a rollback program, the control unit 50 uses the rollback program to execute the rollback process on the update target ECU.
  • the control unit 50 stores a new program in the flash memory of the update target ECU. For example, if the first memory is where an old program is to be stored and the second memory is where a new program is to be written, the control unit 50 stores the new program written in the second memory. As in the example of (B) of FIG. 3 , if the installation is performed with the ignition switch 13 being turned on and writing of the new program to the second memory is completed, the control unit 50 stores the new program even if the update process is not completed within the estimated update process time.
  • the power supply process execution unit 51 outputs to the power supply system ECU 14 D a control signal for setting to zero the output power of the drive battery, which is an IG power supply of the vehicle 1 , to turn off the ignition of the vehicle 1 .
  • FIG. 5 The flowchart illustrated in FIG. 5 is executed by the controller 40 of the software update device 10 illustrated in FIG. 4 .
  • the flowchart of FIG. 5 is a flowchart for the single bank memory configuration for the update target ECU.
  • the flowchart of FIG. 5 is a flowchart from download (step S 2 ) to confirmation of update completion (step S 5 ) illustrated in FIG. 2 .
  • step S 11 the controller 40 acquires (downloads) a distribution package from the server 2 through the in-vehicle communication device 11 .
  • the distribution package includes update data, authentication data used for an authentication process for the update data, and an estimated update process time.
  • step S 12 the controller 40 acquires the estimated update process time from the distribution package acquired in step S 11 .
  • step S 13 the controller 40 determines whether or not the ignition switch 13 has been switched from on to off by an occupant's operation.
  • the controller 40 acquires a signal indicating the occupant's operation from the ignition switch 13 .
  • the processing proceeds to step S 14 , and when the ignition switch 13 remains on, the processing waits in step S 13 until the ignition switch is switched from on to off by the occupant.
  • step S 14 the controller 40 outputs consent request information for asking the user for consent to start the update process for software.
  • the controller 40 transmits consent request information to the server 2 through the in-vehicle communication device 11 . After that, the consent request information is transmitted from the server 2 to the user terminal 3 .
  • step S 15 the controller 40 determines whether or not the user has consented to the consent request information output in step S 14 .
  • consent information is transmitted from the user terminal 3 to the server 2 as response information from the user in response to the consent request information.
  • the controller 40 acquires the consent information from the server 2 and determines that the update process is to start. In this case, the processing proceeds to step S 16 .
  • refusal information is transmitted from the user terminal 3 to the server 2 as response information from the user in response to the consent request information.
  • the controller 40 acquires the refusal information from the server 2 and determines that the update process is not to start. In this case, the processing proceeds to step S 19 .
  • step S 15 the processing proceeds to step S 16 .
  • step S 16 the controller 40 starts software update process for the update target ECU. Specifically, for the single bank memory configuration for the ECU, the controller 40 executes the installation process and activation process as illustrated in the example of (A) of FIG. 3 . The specific content of each process follows the above description. Further, in this step, the controller 40 starts a timer for measuring the update process time and starts measuring the elapsed time from the start of the update process.
  • step S 17 the controller 40 determines whether or not the update process started in step S 16 has been successfully completed.
  • the controller 40 determines that the update process has been successfully completed. In this case, the processing proceeds to step S 18 .
  • the controller 40 determines that the update process has not been successfully completed. In this case, the processing proceeds to step S 20 .
  • step S 18 the controller 40 determines a new program as the target program to be executed by the update target ECU, and causes the update target ECU to execute the new program.
  • step S 19 the controller 40 executes a process of turning off the ignition of the vehicle 1 as a process associated with an occupant's operation on the ignition switch in step S 13 . Specifically, the controller 40 outputs a control signal for turning off the ignition of vehicle 1 to the power supply system ECU 14 D.
  • step S 20 the controller 40 determines whether or not the update process has ended abnormally. For example, when the controller 40 receives an abnormal end notification from the update target ECU, the controller 40 determines that the update process has ended abnormally. In this case, the processing proceeds to step S 21 . On the other hand, for example, when the controller 40 does not receive an abnormal end notification from the update target ECU, the controller 40 determines that the update process has not ended abnormally. In this case, the processing proceeds to step S 22 .
  • step S 21 the controller 40 determines an old program as the target program to be executed by the update target ECU, and causes the update target ECU to execute the old program. For example, the controller 40 performs the rollback process on the update target ECU.
  • step S 19 the processing proceeds to step S 19 , and accordingly, the controller 40 executes the process of step S 19 described above.
  • step S 22 the controller 40 determines whether or not the elapsed time that started to be measured in step S 16 exceeds the estimated update process time acquired in step S 12 . If the controller 40 determines that the elapsed time exceeds the estimated update process time, the processing proceeds to step S 21 , and accordingly, the controller 40 executes the process of step S 21 described above. On the other hand, if the controller 40 determines that the elapsed time does not exceed the estimated update process time, the processing returns to step S 17 , and from then on, the processes of the steps described above are executed until the processing of FIG. 5 ends.
  • step S 11 when the process of step S 11 ends, the controller 40 executes the installation process using the new program acquired in step S 11 before proceeding to step S 12 .
  • the controller 40 executes the installation process as illustrated in the example of (B) of FIG. 3 .
  • the specific content of the process follows the above description.
  • step S 12 the controller 40 acquires an estimated time for the activation process as the estimated update process time. Accordingly, the target of comparison with the elapsed time in step S 22 is the estimated process time for the activation process.
  • step S 16 the controller 40 executes the activation process as a software update process for the update target ECU. For the double bank memory configuration for the ECU, the controller 40 executes the activation process as illustrated in the example of (B) of FIG. 3 . The specific content of the process follows the above description. Further, in step S 21 , the controller 40 stores the new program written in the memory, and switches the load destination for the microcomputer of the ECU to the memory where the old program is stored.
  • the software update device 10 is a software update device that updates the software for the body system ECU 14 A, the traveling system ECU 14 B, and the multimedia system ECU 14 C, which are mounted in the vehicle 1 .
  • the software update device 10 includes the output unit 43 , the update process execution unit 45 , and the control unit 50 .
  • the output unit 43 acquires update process information related to an update of software from the server 2 .
  • the update process execution unit 45 executes an update process according to response information that is a response to consent request information from the user.
  • the control unit 50 determines a target program to be executed by the update target ECU based on an estimated update process time. Further, when the update process is not completed within the estimated update process time, the control unit 50 causes the update target ECU to execute an old program; when the software update is completed within the estimated update process time, the control unit 50 causes the update target ECU to execute a new program.
  • examples of causes of an error that the software update process does not end include the surrounding environment of the update target ECU and the like. For example, when the ambient temperature of the update target ECU rises due to some reason, the update target ECU executes a self-diagnosis process based on a detection result from a temperature sensor, and the computational load on the microcomputer is increased. It is believed that when the computational load on the microcomputer is increased, the processing speed on the microcomputer is reduced, leading to an error that the update process does not end.
  • a target program to be executed by the update target ECU can be determined, so that the vehicle 1 becomes available, allowing the user to use the vehicle 1 .
  • the information acquisition unit 41 acquires the estimated update process time from the server 2 .
  • the target program to be executed by the update target ECU can be determined without the software update device 10 calculating the updated estimate process time, so that the computational load on the software update device 10 can be reduced.
  • the update target ECU includes the flash memory that stores an old program
  • the update process execution unit 45 includes the first installation execution unit 46 and the first activation execution unit 47 .
  • the first installation execution unit 46 executes an installation process for writing a new program to the flash memory after deleting the old program from the flash memory.
  • the first activation execution unit 47 executes an activation process for causing the microcomputer to load the new program written in the flash memory.
  • the control unit 50 executes the rollback process on the update target ECU.
  • the update target ECU includes the flash memory configured with the double bank composed of the first memory storing an old program and the second memory
  • the update process execution unit 45 includes the second installation execution unit 48 and the second activation execution unit 49 .
  • the second installation execution unit 48 writes a new program into the second memory.
  • the second activation execution unit 49 executes an activation process for changing the program load destination for the microcomputer from the first memory to the second memory.
  • the control unit 50 stores the new program written in the second memory, as a process for the update process being not completed within the estimated update process time. Since the new program can be stored in the second memory of the update target ECU, there is no need to install the new program when the update process is performed again, and the computational load on the software update device 10 can be reduced.
  • the server 2 calculates the estimated update process time based on at least one of the size of the update data and the type of the update target ECU. As a result, the computational load on the software update device 10 can be reduced.
  • the software update device 10 acquires the estimated update process time from the server 2 in the present embodiment, but the subject that calculates the estimated update process time is not limited to the server 2 , and the software update device 10 may calculate the estimated update process time.
  • the controller 40 may include as a functional block a calculation unit that calculates the estimated update process time based on at least one of the data size of the update data and the type of the update target ECU. For example, if a map indicating a relationship between a data size of update data and an estimated update process time is stored in the storage unit 42 in advance, the calculation unit may refer to the map to calculate the estimated update process time corresponding to the data size. Further, for example, the calculation unit may calculate the estimated update process time such that it is longer as the data size of the update data is larger. Further, for example, the calculation unit may calculate the estimated update process time based on the specifications of the microcomputer and/or flash memory included in the ECU.
  • the calculation method include the examples of the calculation method in the control device 23 described above.
  • the computational load on the server 2 can be reduced by the software update device 10 calculating the estimated update process time.
  • the timing at which the controller 40 calculates the estimated update process time is not particularly limited as long as it is before the start of the update process, and for example, in step S 12 of the flowchart of FIG. 5 , the controller 40 calculates the estimated update process time instead of acquiring the estimated update process time.
  • step S 3 the installation (step S 3 ) and the activation (step S 4 ) have been described by way of examples among the steps for an update of software by OTP illustrated in FIG. 2 .
  • step S 2 an example including the download (step S 2 ) in addition to the installation and the activation will be described.
  • the user is asked to consent to start an update after campaign information is notified in step S 1 , and if the user consents to that, then the download to the activation are sequentially performed without requesting the user's consent.
  • An example is a scene where software is updated by OTP in a situation where the vehicle is not being used by the user, such as when the vehicle is parked in a home parking lot.
  • a software update system according to the second embodiment is different from the software update system 100 according to the first embodiment in an estimated time calculated by the server 2 and the functional blocks included in the controller 60 of the software update device 10 , and except for that, it has the same configuration as the software update system 100 according to the first embodiment.
  • the same configuration as the first embodiment follows the above description.
  • the server 2 calculates the sum of an estimated download time required to complete the download of a distribution package and an estimated update process time of the first embodiment, as an estimated time until an update of software is completed (estimated update completion time).
  • the server 2 distributes campaign information including the estimated update completion time to one or more vehicles 1 .
  • the control device 23 of the server 2 calculates the estimated download time based on the data size of the distribution package. For example, if a map indicating a relationship between the data size of a distribution package and an estimated download time is stored in the database 22 in advance, the control device 23 refers to the map to calculate the estimated download time corresponding to the data size. Further, for example, the control device 23 calculates the estimated download time such that it is longer as the data size of the distribution package is larger.
  • FIG. 6 is an example of functional blocks included in a controller 60 of the software update device 10 according to the present embodiment.
  • the controller 60 includes a communication status acquisition unit 52 , a correction unit 53 , and a notification unit 54 in addition to the functional blocks of the first embodiment.
  • the function of the output unit 43 is partially different from that of the first embodiment.
  • the controller 60 implements each function of the functional blocks using software stored in the memory. Note that the same functional blocks as those in the first embodiment follow the description in the first embodiment.
  • the output unit 43 outputs consent request information for asking the user whether or not to consent to the update of software, including not only the update process by the update process execution unit 45 but also the download of a distribution package from the server 2 .
  • a specific example of the consent request information and a method for transmitting the consent request information to the user terminal 3 follows the description in the first embodiment.
  • the output unit 43 outputs the consent request information in a period from when the information acquisition unit 41 acquires campaign information and to when the information acquisition unit 41 acquires a distribution package.
  • the communication status acquisition unit 52 acquires communication status information related to a communication status with the server 2 .
  • the communication status acquisition unit 52 detects a state of communication between the in-vehicle communication device 11 and the communication device 21 of the server 2 , and acquires the detected state of communication as communication status information. For example, for a state where communication is not established between the in-vehicle communication device 11 and the communication device 21 , the communication status acquisition unit 52 detects that the state of communication is abnormal. Further, the communication status acquisition unit 52 may calculate a delay time in wireless data communication.
  • the delay time includes a fixed delay time that is determined by the capability of the in-vehicle communication device 11 and a delay time that varies depending on the number of communication devices accessing the wireless communication network 4 , the size of data to be communicated (communication fee), and the like.
  • a technology for acquiring communication status known at the time of filing of the present application can be applied to the communication status acquisition unit 52 .
  • the correction unit 53 acquires the estimated update completion time from the campaign information, and corrects the estimated update completion time based on the communication status information acquired by the communication status acquisition unit 52 .
  • the estimated download time calculated by the server 2 does not take into account the actual communication status, so that there is a possibility that the estimated download time and the actual download time will differ.
  • an excellent state of communication between the in-vehicle communication device 11 and the communication device 21 results in a short delay time in wireless data communication, so that the actual download time may be shorter than the estimated download time.
  • the correction unit 53 shortens the estimated download time according to the delay time in wireless data communication.
  • the correction unit 53 extends the estimated download time according to the delay time in wireless data communication included in the communication status information.
  • the notification unit 54 outputs information on an estimated update time (hereinafter referred to as the estimated update time after correction) that is the sum of the estimated download time corrected by the correction unit 53 (hereinafter referred to as the estimated download time after correction) and the estimated update process time.
  • the notification unit 54 transmits the information on the estimated update time after correction to the server 2 through the in-vehicle communication device 11 .
  • the information on the estimated update time after correction transmitted from the in-vehicle communication device 11 is received by the server 2 , and then transmitted from the server 2 to the user terminal 3 .
  • the user is notified of the estimated time after correction.
  • the notification unit 54 may output the estimated update time after correction if the estimated update time after correction is longer by a predetermined threshold time than the estimated update time calculated by the server 2 (hereinafter referred to as the estimated update time before correction), which is an output condition for outputting the information on the estimated update time after correction.
  • the predetermined threshold time is, for example, a predetermined time in minutes, such as 5 minutes. If the actual update time is expected to be significantly longer than the estimated time, this is likely to affect the user's decision as to whether or not to consent to the update. Therefore, the user is notified of the update time after correction before a distribution package is downloaded.
  • the notification unit 54 does not need to output the estimated time after correction. If the actual update time is expected to be shorter than the estimated time, this is less likely to affect the user's decision as to whether or not to consent to the update. Therefore, the user is not notified of the update time after correction before a distribution package is downloaded.
  • FIG. 7 The flowchart illustrated in FIG. 7 is executed by the controller 60 of the software update device 10 illustrated in FIG. 6 .
  • the flowchart of FIG. 7 is a flowchart for the single bank memory configuration for the update target ECU.
  • the flowchart in FIG. 7 is a flowchart from notification of campaign information (step S 1 ) to confirmation of update completion (step S 5 ) illustrated in FIG. 2 .
  • the flowchart of FIG. 7 includes some of the same steps as the flowchart of FIG. 6 .
  • the same steps as those in FIG. 6 are given the same reference numerals as those in FIG.
  • step S 19 illustrated in FIG. 6 is omitted. Note that in the flowchart of FIG. 7 , the process of step S 19 illustrated in FIG. 6 may be performed.
  • step S 31 the controller 60 acquires (downloads) campaign information from the server 2 through the in-vehicle communication device 11 .
  • the campaign information includes the data size of the update data, information for identifying the update target ECU, information on the version of the software to be updated, a general description of the function to be updated, an estimated download time, an estimated update process time, and the like.
  • step S 32 the controller 60 acquires, from the campaign information acquired in step S 31 , an estimated update time that is the sum of the estimated download time and the estimated update process time.
  • step S 33 the controller 60 corrects the estimated download time of the estimated update time acquired in step S 32 , based on the communication status information related to the communication status with the server 2 .
  • the controller 60 outputs an estimated update time after correction that is the sum of the corrected estimated download time and the estimated update process time acquired in step S 31 .
  • the controller 60 transmits the estimated update time after correction to the user terminal 3 through the in-vehicle communication device 11 and the server 2 .
  • step S 34 the controller 60 outputs consent request information for asking the user for consent to an update of software.
  • the controller 60 transmits the consent request information to the user terminal 3 through the in-vehicle communication device 11 and the server 2 .
  • step S 35 the controller 60 determines whether or not the user has consented to the consent request information output in step S 34 .
  • consent information is transmitted from the user terminal 3 to the server 2 as response information from the user in response to the consent request information.
  • the controller 60 acquires the consent information from the server 2 and determines that the update of software is to start. Further, in the present embodiment, if it is determined that the user has consented, the controller 60 starts a timer for measuring the download time of a distribution package and the update process time and starts measuring the elapsed time from the download of the distribution package.
  • refusal information is transmitted from the user terminal 3 to the server 2 as response information from the user in response to the consent request information.
  • the controller 60 acquires the refusal information from the server 2 , and the processing of the flowchart illustrated in FIG. 7 ends.
  • step S 35 If it is determined in step S 35 that the user has consented, the processing proceeds to step S 11 , and accordingly, the controller 60 starts download of the distribution package, as in the first embodiment. After the download of the distribution package is completed, the processing proceeds to step S 16 , and accordingly, the controller 60 starts the update process, as in the first embodiment.
  • Step S 36 is a step corresponding to step S 22 illustrated in FIG. 5 .
  • the controller 60 compares the measurement time at the start of measurement when the user consented in step S 35 and the estimated update time after correction corrected in step S 33 to determine whether or not the elapsed time exceeds the estimated update time after correction. This differs from step S 22 in the start timing of measurement of elapsed time and the comparison target of elapsed time, and except for that, it is the same as step S 22 , following the above description.
  • the software update device 10 includes the communication status acquisition unit 52 , the correction unit 53 , and the notification unit 54 .
  • the communication status acquisition unit 52 acquires communication status information related to a communication status with the server 2 .
  • the correction unit 53 corrects the estimated update time based on the communication status information.
  • the notification unit 54 outputs information on the estimated update time after correction. As a result, it possible to improve the accuracy of the estimated download time. Further, since the user can be notified of the estimated update time including the estimated download time, the user can know the estimated time required for an update of software including download.
  • the notification unit 54 when the estimated update time after correction is longer than the estimated update time before correction by a predetermined threshold time or more, the notification unit 54 outputs information on the estimated update time after correction. As a result, for example, even when the actual download time is longer than the estimated download time due to a poor state of communication between the in-vehicle communication device 11 and the communication device 21 , the user can know the estimated time involving the actual communication status.
  • the notification unit 54 when the estimated update time after correction is shorter than the estimated update time before correction, the notification unit 54 does not output information on the estimated update time after correction.
  • the process of notifying the user of the estimated time can be eliminated. Consequently, it is possible to reduce the time required for the entire software update flow by OTP.
  • the estimated update process time” in the first embodiment can be replaced with “the estimated update time that is the sum of the estimated download time and the estimated update process time” in the second embodiment.
  • the controller 40 includes the calculation unit that calculates the estimated update process time
  • the controller 60 according to the second embodiment may include a calculation unit that calculates the estimated download time of the estimated update time.
  • the information acquisition unit 41 acquires information about the travel route of the vehicle 1 from a navigation system (not illustrated) of the vehicle 1 .
  • the calculation unit calculates the estimated download time based on the communication status information acquired by the communication status acquisition unit 52 and the travel route of the vehicle 1 acquired by the information acquisition unit 41 .
  • the calculation unit acquires communication status information of the wireless communication network 4 at a plurality of points on the travel route from a communication map that indicates the communication status of the wireless communication network 4 provided by a communication carrier.
  • the calculation unit calculates the estimated download time when the vehicle 1 travels along the travel route based on the communication status information on the travel route of the vehicle 1 .
  • the accuracy of the estimated download time when a distribution package is downloaded while the vehicle 1 is in a state of being able to travel can be improved.
  • the present invention is not limited to the configuration for correcting the estimated update time.
  • the controller 60 may use the estimated update time before correction to determine a target program to be executed by the update target ECU.
  • the controller 60 may, before the process of each step starts, output consent request information for asking the user whether or not to consent to start the process. Further, as a process for the double bank memory configuration and when the elapsed time exceeds the estimated update time (including the estimated update time after correction), the controller 60 may execute a rollback process on the update target ECU. For example, in the flowchart of FIG.
  • step S 36 it is now assumed that the actual download time is longer than the estimated download time, and when the installation process being executed, it is determined that the elapsed time exceeds the estimated update time after correction (Yes in step S 36 ).
  • the controller 60 executes a rollback process on the update target ECU. Even for the double bank memory configuration for the update target ECU and when writing of a new program has not been completed, a target program to be executed by the update target ECU can be determined, so that the vehicle 1 becomes available, allowing the user to use the vehicle 1 .
  • the controller 60 may include a measurement unit that measures the actual required time required from the start to the completion of the update process.
  • the output unit 43 transmits information on the actual required time required for the update process to the server 2 through the in-vehicle communication device 11 . This can be reflected in the estimated update process time for other vehicles 1 for which software has not been updated, and the accuracy of the estimated update process time can be improved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Human Computer Interaction (AREA)
  • Stored Programmes (AREA)
US18/292,251 2021-07-27 2021-07-27 Software update device, software update system, and software update method Pending US20240362007A1 (en)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2021/027686 WO2023007577A1 (ja) 2021-07-27 2021-07-27 ソフトウェア更新装置、ソフトウェア更新システム、及びソフトウェア更新方法

Publications (1)

Publication Number Publication Date
US20240362007A1 true US20240362007A1 (en) 2024-10-31

Family

ID=85086413

Family Applications (1)

Application Number Title Priority Date Filing Date
US18/292,251 Pending US20240362007A1 (en) 2021-07-27 2021-07-27 Software update device, software update system, and software update method

Country Status (5)

Country Link
US (1) US20240362007A1 (https=)
EP (1) EP4379540A4 (https=)
JP (1) JP7647894B2 (https=)
CN (1) CN117651932A (https=)
WO (1) WO2023007577A1 (https=)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20240118885A1 (en) * 2022-10-05 2024-04-11 Toyota Jidosha Kabushiki Kaisha User equipment, software update system, control method, and non-transitory storage medium
US20250115258A1 (en) * 2021-09-07 2025-04-10 Autonetworks Technologies, Ltd. In-vehicle system, in-vehicle device, and software switching method

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP7673719B2 (ja) * 2022-10-05 2025-05-09 トヨタ自動車株式会社 モバイル端末、ソフトウェア配信システム
JP7819660B2 (ja) * 2023-03-13 2026-02-25 トヨタ自動車株式会社 ソフトウェアの更新装置、ソフトウェアの更新プログラム、ソフトウェアの更新方法、及びソフトウェアの更新システム
US12524224B2 (en) 2023-05-15 2026-01-13 Honda Motor Co., Ltd. Program update control apparatus, program update control method and non-transitory computer-readable storage medium
JP2025080073A (ja) * 2023-11-13 2025-05-23 トヨタ自動車株式会社 制御装置、制御方法、及び記憶媒体
US12602220B2 (en) 2023-12-14 2026-04-14 Honda Motor Co., Ltd. Program update method, program update system and mobile object

Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080258758A1 (en) * 2006-12-28 2008-10-23 Fujitsu Limited Embedded system and control method therefor
US20110307882A1 (en) * 2009-03-31 2011-12-15 Toyota Jidosha Kabushiki Kaisha Vehicle-mounted software updating apparatus
US20150339114A1 (en) * 2014-05-20 2015-11-26 Ford Global Technologies, Llc Module interface for vehicle updates
US20170123782A1 (en) * 2015-10-29 2017-05-04 Hyundai Motor Company Terminal, vehicle, and method for controlling the same
US20170139698A1 (en) * 2015-11-18 2017-05-18 Fujitsu Limited Information processing apparatus and program update control method
US20170315797A1 (en) * 2016-05-02 2017-11-02 Ford Global Technologies, Llc Vehicle connection location regional software delivery
JP6692729B2 (ja) * 2016-09-29 2020-05-13 京セラ株式会社 ファームウェア提供システム、ファームウェア提供システムの制御方法及び電源システム
US20210157902A1 (en) * 2018-08-10 2021-05-27 Denso Corporation Vehicle information communication system
US20210173635A1 (en) * 2019-12-06 2021-06-10 Hyundai Motor Company Vehicle terminal and software update method thereof
US20220012043A1 (en) * 2018-08-10 2022-01-13 Denso Corporation Vehicle information communication system
US20220027166A1 (en) * 2019-12-09 2022-01-27 Panasonic Intellectual Property Management Co., Ltd. Information processing device, moving object, and information processing method
US20220204008A1 (en) * 2019-05-28 2022-06-30 Hitachi Astemo, Ltd. Arithmetic processing device, vehicle control device, and update method
US20250300935A1 (en) * 2022-12-09 2025-09-25 Samsung Electronics Co., Ltd. Electronic device for performing gro by using artificial intelligence model and operating method thereof

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4946088B2 (ja) * 2006-02-17 2012-06-06 株式会社日立製作所 業務運用環境の構築方法
JP4487007B2 (ja) * 2008-11-14 2010-06-23 株式会社小松製作所 車載プログラムの書き換え制御システム
JP6281440B2 (ja) 2014-08-05 2018-02-21 株式会社デンソー 情報処理端末、及び更新制御プログラム
JP6525598B2 (ja) * 2015-01-15 2019-06-05 富士フイルム株式会社 放射線画像撮影システム、放射線画像撮影装置、処理実行装置、放射線画像撮影システムの制御方法、放射線画像撮影装置の制御方法、処理実行装置の制御方法、放射線画像撮影システムの制御プログラム、放射線画像撮影装置の制御プログラム、及び処理実行装置の制御プログラム
JP2018124605A (ja) * 2017-01-30 2018-08-09 オムロン株式会社 画像処理システム、情報処理装置、情報処理方法、および、情報処理プログラム
WO2020032200A1 (ja) * 2018-08-10 2020-02-13 株式会社デンソー センター装置，諸元データの生成方法及び諸元データ生成用プログラム
JP7320415B2 (ja) * 2019-09-13 2023-08-03 東芝テック株式会社 処理装置及び起動方法

Patent Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080258758A1 (en) * 2006-12-28 2008-10-23 Fujitsu Limited Embedded system and control method therefor
US20110307882A1 (en) * 2009-03-31 2011-12-15 Toyota Jidosha Kabushiki Kaisha Vehicle-mounted software updating apparatus
US20150339114A1 (en) * 2014-05-20 2015-11-26 Ford Global Technologies, Llc Module interface for vehicle updates
US20170123782A1 (en) * 2015-10-29 2017-05-04 Hyundai Motor Company Terminal, vehicle, and method for controlling the same
US20170139698A1 (en) * 2015-11-18 2017-05-18 Fujitsu Limited Information processing apparatus and program update control method
US20170315797A1 (en) * 2016-05-02 2017-11-02 Ford Global Technologies, Llc Vehicle connection location regional software delivery
JP6692729B2 (ja) * 2016-09-29 2020-05-13 京セラ株式会社 ファームウェア提供システム、ファームウェア提供システムの制御方法及び電源システム
US20210157902A1 (en) * 2018-08-10 2021-05-27 Denso Corporation Vehicle information communication system
US20220012043A1 (en) * 2018-08-10 2022-01-13 Denso Corporation Vehicle information communication system
US20220204008A1 (en) * 2019-05-28 2022-06-30 Hitachi Astemo, Ltd. Arithmetic processing device, vehicle control device, and update method
US20210173635A1 (en) * 2019-12-06 2021-06-10 Hyundai Motor Company Vehicle terminal and software update method thereof
US20220027166A1 (en) * 2019-12-09 2022-01-27 Panasonic Intellectual Property Management Co., Ltd. Information processing device, moving object, and information processing method
US20250300935A1 (en) * 2022-12-09 2025-09-25 Samsung Electronics Co., Ltd. Electronic device for performing gro by using artificial intelligence model and operating method thereof

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20250115258A1 (en) * 2021-09-07 2025-04-10 Autonetworks Technologies, Ltd. In-vehicle system, in-vehicle device, and software switching method
US20240118885A1 (en) * 2022-10-05 2024-04-11 Toyota Jidosha Kabushiki Kaisha User equipment, software update system, control method, and non-transitory storage medium

Also Published As

Publication number Publication date
JPWO2023007577A1 (https=) 2023-02-02
EP4379540A1 (en) 2024-06-05
EP4379540A4 (en) 2024-08-14
WO2023007577A1 (ja) 2023-02-02
JP7647894B2 (ja) 2025-03-18
CN117651932A (zh) 2024-03-05

Similar Documents

Publication Publication Date Title
US20240362007A1 (en) Software update device, software update system, and software update method
US12030443B2 (en) Vehicle electronic control system, distribution package download determination method and computer program product
US12083970B2 (en) Vehicle master device, vehicle electronic control system, activation request instruction method and computer program product
CN109643254B (zh) 车载更新系统、车载更新装置及通信装置的更新方法
US20210157529A1 (en) Center device, specification data generation method and computer program product for generating specification data
US20210191661A1 (en) Electronic control unit, vehicle electronic control system, rewrite execution method, rewrite execution program, and data structure of specification data
US20210167988A1 (en) Vehicle master device, update data distribution control method, computer program product and data structure of specification data
US20210255805A1 (en) Vehicle master device, update data verification method and computer program product
US12087103B2 (en) Electronic control unit and non-transitory computer readable medium storing session establishment program
US12174977B2 (en) Center device on a vehicle network, data distribution system and storage medium storing computer program for distribution control for re-programming ECUS
US11928459B2 (en) Electronic control unit, retry point specifying method and computer program product for specifying retry point
US11604637B2 (en) Electronic control unit, vehicle electronic control system, difference data consistency determination method and computer program product
US11169797B2 (en) Vehicle controller configuration backup and restoration using data snapshots
US12381949B2 (en) Vehicle master device, update data verification method and computer program product
US20210157574A1 (en) Vehicle master device, non-rewrite target power supply administration method and computer program product
JP2025105856A (ja) ソフトウェア更新装置、ソフトウェア更新システム、及びソフトウェア更新方法
WO2018230314A1 (ja) 制御装置、制御方法、およびコンピュータプログラム
US11770690B2 (en) Center device, data communication system, and data communication program product
US11907697B2 (en) Vehicle electronic control system, center device, vehicle master device, display control information transmission control method, display control information reception control method, display control information transmission control program, and display control information reception control program
KR20160045191A (ko) 차량의 소프트웨어 업데이트 장치 및 방법
JP2020004245A (ja) プログラム更新装置、プログラム更新システム、プログラム更新方法、およびプログラム更新プログラム
US20250004749A1 (en) Management apparatus, management system, management method, and computer program
US12175817B2 (en) Center device and vehicle information communication system
JP2006312356A (ja) 車両制御システム
JPWO2023007577A5 (https=)

Legal Events

Date Code Title Description
STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

AS Assignment

Owner name: NISSAN MOTOR CO., LTD., JAPAN

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KIKUCHI, MITSUHIKO;MORITA, KOJI;SHIZUKA, YOSHIMORI;AND OTHERS;SIGNING DATES FROM 20231216 TO 20240831;REEL/FRAME:068612/0065

STPP Information on status: patent application and granting procedure in general

Free format text: ALLOWED -- NOTICE OF ALLOWANCE NOT YET MAILED

Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS

STPP Information on status: patent application and granting procedure in general

Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS

STPP Information on status: patent application and granting procedure in general

Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT RECEIVED

Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT VERIFIED